NVD

Id
21122  
Name
CVE-2016-6321  
Description
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-12-09  
Modified Date
2017-01-06  
Seq
2016-6321  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
115009 21122 CVE-2016-6321 http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d  View
115010 21122 CVE-2016-6321 [bug-tar] 20161029 Re: [Bug-tar] possible fixes for CVE-2016-6321  View
115011 21122 CVE-2016-6321 http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html  View
115012 21122 CVE-2016-6321 20161030 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update  View
115013 21122 CVE-2016-6321 20161026 [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321)  View
115014 21122 CVE-2016-6321 DSA-3702  View
115015 21122 CVE-2016-6321 93937  View
115016 21122 CVE-2016-6321 USN-3132-1  View
115017 21122 CVE-2016-6321 https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
5477 JVNDB-2016-006250 GNU tar の safer_name_suffix 関数におけるディレクトリトラバーサルの脆弱性 GNU tar の safer_name_suffix 関数には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2016-6321 92828 CVE-2016-6321 21122 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-006250.html 2016-10-29 2016-12-16 View